PT-2026-103061

An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination or arbitrary code execution...

PT-2026-103543

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An endpoint used during the initial appliance setup lacks authentication and fails to correctly enforce its intended state precondition. This allows an...

PT-2026-105534

Summary In the Astro Node adapter, a request whose Host header contains a malformed port for example example.com:65536 or example.com:8080:8080 produced an invalid request URL. The fallback intended to recover from an unparseable URL reused the same malformed host, so it failed again and raised a...

CVE-2026-18145: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability in the spamBlocker spamd service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrary code by sending a specially crafted management request...

CVE-2026-103471: Allocation of Resources Without Limits or Throttling

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exhaust server memory. Attackers can open TCP connections and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate...

AlmaLinux 9.2 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc (ALMALINUX9.2:CLSA-2026:1768412660)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1768412660 advisory. - When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length. This allow...

UBUNTU-CVE-2026-16271

hw/display/qxl: validate primary surface stride against width...

The vulnerability of the cfsrvl PhyidMatch() function in the net/caif/cfsrvl.c module of the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the cfsrvl PhyidMatch function in the net/caif/cfsrvl.c module of the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

PT-2026-103590

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.19.0 Description A crafted PDF containing numerous embedded files can cause the dictionary-based attachments API in pypdf/ doc common.py to reparse the entire attachment list during every content lookup. This results ...

PT-2026-103584

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.17.0 Description A crafted PDF file can contain unusually large Roman page-label values. When an application retrieves document page labels, the pypdf/ page labels.py module generates excessively large numeral strings...

PT-2026-103585

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.18.0 Description A flaw in the way the library handles crafted PDF files can lead to uncontrolled resource consumption. Specifically, when a PDF contains indirect-object identifiers or generation-number tokens that...

PT-2026-103588

Name of the Vulnerable Software and Affected Versions pypdf versions prior to 6.18.1 Description A crafted PDF containing a partially malformed /FlateDecode stream with padded data can force the pypdf/filters.py file to use inefficient byte-by-byte decompression. This occurs because the recovery...

PT-2026-103484

Name of the Vulnerable Software and Affected Versions @angular/router versions prior to 20.3.32 @angular/router versions prior to 21.2.24 @angular/router versions prior to 22.2.0 Description A denial of service DoS issue exists in @angular/router when Server-Side Rendering SSR is enabled on...

PT-2026-103521

basic-ftp is an FTP client for Node.js. Prior to 6.2.1, Client.list can be forced by a malicious or compromised FTP server to spend quadratic CPU time parsing a directory listing because the RE LINE expression in src/parseListUnix.ts backtracks across adjacent variable-length owner and group fiel...

PT-2026-103281

Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing...

CVE-2026-102509: Memory Allocation with Excessive Size Value

Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation of Apache PLC4X PLC4J allow a malicious or impersonated device to exhaust the memory or stack of the client application, causing a denial of service. In the O...

PT-2026-103012

Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service...

AlmaLinux 9.2 [TuxCare] Security Update: expat / expat-devel / expat-static Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2024:1725650114)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1725650114 advisory. - An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer. CVE-2024-45490 ...

AlmaLinux 9.6 [TuxCare] Security Update: 389-ds-base / 389-ds-base-devel / 389-ds-base-libs / etc (ALMALINUX9.6:CLSA-2026:1772574256)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1772574256 advisory. - A flaw was found in the 389-ds-base server. A heap buffer overflow vulnerability exists in the schemaattrenumcallback function within the...

SUSE SLED15 / SLES15 Security Update : netty, netty-tcnative (SUSE-SU-2026:4391-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4391-1 advisory. - CVE-2026-59902: Netty: Memory Exhaustion in SctpMessageCompletionHandler bsc1275501. - CVE-2026-59903: Netty...